This policy covers both sides of what we do. It explains how ICT Vision handles personal information on our websites and in our business dealings, and it explains separately how the ICT Exam platform handles institution, teacher and student data. If you're a school evaluating us, the student data sections are the ones you want.

The two roles we play

Which rules apply depends on whose data it is, so it's worth separating clearly.For our own websites, marketing and billing, we decide what to collect and why. In data protection terms we're the controller.For student data inside ICT Exam, we're not the decision maker. Your institution is. The school or college decides which students take which exams, what questions are asked, and how long records are kept. We process that data on the institution's instructions and for no other purpose. In data protection terms we're the processor, and under FERPA we act as a school official performing a service the institution would otherwise perform itself.

What we collect

Category	What it includes	Where it comes from
Website visitors	IP address, browser type, pages viewed, date, time and language	Collected automatically when you visit
Enquiries	Name, email, organisation and whatever you write to us	You, when you contact us or ask for a demo
Account holders	Name, email, institution, role and login credentials for admins and teachers	You, or your institution's administrator
Billing	Company name, billing address, plan and invoice history	You, at checkout
Students	Name, role, LMS user identifier and course context	Your LMS, sent to us at launch over LTI
Exam content	Question papers you upload, questions you build, student answers, marks and grading notes	Teachers and students using the platform
Service logs	Launch records, timestamps, submission events and error logs	Generated as the platform runs

What we don't collect

• We don't store card or bank details. Payment is handled entirely by established payment merchants.
• Students don't create accounts with us. A published exam produces a single link, and a student opens it without signing up, so we never ask a student for a password, a personal email or a date of birth.
• We don't ask for or want special category data such as health records, and you shouldn't put it into exam content.

How student data reaches us

There are two paths, and both are started by the institution.When ICT Exam is connected to your LMS over LTI 1.3, each launch passes us the student's name, role and user identifier from the LMS, along with the course context. Roster sync uses Names and Role Provisioning Services to keep the class list current. When grading is confirmed, marks go back to your gradebook through Assignment and Grade Services. Each LMS issuer is a separate tenant key, so one institution's data is isolated from every other institution's.When a teacher shares a direct exam link instead, we receive whatever identifier the teacher asks students to enter, plus the answers they submit.

How we use AI, and what we don't do with your data

AI does three jobs in ICT Exam, and it's worth being precise about each.

• Reading uploaded papers. Text recognition reads PDFs, scans and photos so the questions can be pulled out instead of retyped.
• Structuring questions. The extracted text is organised into question types and laid out in the builder for a teacher to review. A teacher confirms the result before an exam is published.
• Supporting grading. Objective answers are marked automatically. Written and essay answers are scored with AI assistance, and a teacher reviews and signs off the marks. AI doesn't release a grade on its own.

Alongside that, here's what we commit to:

• We don't use student data to train AI models, ours or anyone else's.
• We don't use student data for advertising, and we don't build advertising or marketing profiles of students.
• We don't sell, rent or trade personal information. This applies to student data and to company data.
• We don't use exam content for any purpose other than delivering the service to the institution that owns it.

Who else is involved

Running the platform takes a small number of service providers. They fall into these groups:

• Cloud hosting and storage for the application and its database.
• An AI model provider for text recognition, question parsing and grading support.
• A payment merchant for subscriptions and invoices.
• Email delivery for account and service notifications.

Each one is limited to what it needs to do its job and is not allowed to use your data for its own purposes. We'll tell you who our current providers are if you ask, and institutions signing a data processing agreement can request the list in writing.Beyond that, we share personal information only where the law requires it, or where you or your institution asks us to.

Where your data is processed

ICT Exam runs on cloud infrastructure, so your data may be processed in a country other than your own. Where a transfer needs a legal safeguard, we put one in place. If your institution has a requirement about which region its data sits in, raise it before you sign and we'll tell you honestly whether we can meet it.

How long we keep things

Exam content and student records stay available for as long as your institution's account is active, because that's what makes results, appeals and record keeping possible. We delete them when your institution asks us to, and after an account closes we remove them once any outstanding billing and legal obligations are settled. Backups roll off on their own cycle shortly after.Enquiries and billing records are kept for as long as we need them for accounting and tax purposes.If your institution needs a specific retention period written into an agreement, we can do that.

Security

Protecting this data matters to us and we take reasonable technical and organisational measures to do it. Traffic runs over encrypted connections, LTI launches are signed and verified, tenants are separated by issuer, and access to production data is limited to staff who need it.We'll be straight with you about the limit here. No method of transmitting or storing data online is completely secure, and anyone who claims otherwise is overselling. What we can promise is that no deliberate act on our side will compromise your privacy, and that if a breach affects your data we'll notify the affected institution without undue delay.

Your rights

Depending on where you live you may have the right to see the personal information we hold about you, correct it, ask for it to be deleted, or object to how it's used.For students and parents, the route runs through the institution. Because the school controls the record, a request to see, correct or delete a student's data should go to the school, and we'll help the school act on it. We don't respond to those requests directly, because we can't verify who's entitled to a student's record and the school can.For account holders and website visitors, contact us and we'll handle it.

Children

ICT Exam is sold to institutions, not to children, and students don't register with us. Where an institution uses the platform with pupils under 13, the institution provides the notice and consent its local law requires, and we act on the institution's instructions. We don't knowingly collect personal information directly from a child.

Cookies

We use cookies and similar technologies to keep you signed in, remember your preferences and understand how the site is used so we can improve it. You can clear or block cookies in your browser, though signed-in areas of the platform need them to work.

Changes to this policy

If we change how we handle personal information we'll update this page and move the effective date at the top. For a change that materially affects institutions or student data, we'll tell account holders rather than rely on you spotting it here.

Contact us

Questions about this policy, requests about your data, or a data processing agreement for your institution all go to the same place. Open a ticket and it reaches the right team.Contact ICT Vision